Reading view

There are new articles available, click to refresh the page.

Government to Name ‘Key Witness’ Who Provided FBI With Backdoored Encrypted Chat App Anom

Government to Name ‘Key Witness’ Who Provided FBI With Backdoored Encrypted Chat App Anom

A lawyer defending an alleged distributor of Anom, the encrypted phone company for criminals that the FBI secretly ran and backdoored to intercept tens of millions of messages, is pushing to learn the identity of the confidential human source (CHS) who first created Anom and provided it to the FBI starting the largest sting operation in history, according to recently filed court records. The government says it will provide that identity under discovery, but the CHS may also be revealed in open court if they testify.

The move is significant in that the CHS, who used the pseudonym Afgoo while running Anom, is a likely target for retaliation from violent criminals caught in Anom’s net. The Anom case, called Operation Trojan Shield, implicated hundreds of criminal syndicates in more than 100 countries. That includes South American cocaine traffickers, Australian biker gangs, and kingpins hiding in Dubai. Anom also snagged specific significant drug traffickers like Hakan Ayik, who authorities say heads the Aussie Cartel which brought in more than a billion Australian dollars in profit annually.

Court records say, however, that if this defendant’s case goes to trial, the lawyer believes Afgoo will be the “government’s key witness.”

“Given the CHS’s central role in the investigation and relevance to the prosecution, the government is obligated to provide his identity and particularized information about him,” the motion to compel discovery, filed by defense attorney Patrick M. Griffin in November, reads. Griffin is representing Alexander Dmitrienko, who prosecutors indicted along with 16 others. Lawyers for three other defendants also joined the motion. Those defendants are Seyyed Hossein Hosseini, Aurangzeb Ayub, and Shane Ngakuru.

In 2018 Afgoo, who had previously sold phones from companies popular with organized criminals such as Phantom Secure and Sky, approached the FBI with a proposition: Would the agency like to take control of Anom, an embryonic encrypted phone company Afgoo was developing, for use in its own investigations? In exchange Afgoo received $120,000 and nearly $60,000 for expenses, and the possibility of a reduced sentence for charges they were facing, according to an affidavit written by Nicholas Cheviron, one of the FBI agents that spearheaded the Anom operation.

The opportunity for law enforcement was staggering. They could put a backdoor into Anom to read all of its users’ messages, and once criminals started using the devices, observe and disrupt drug trafficking, weapons smuggling, public corruption, and assassinations all over the globe. Anom eventually grew to more than 12,000 devices and collected more than 27 million messages.

“The CHS was an active participant in the alleged conspiracy; indeed, acting on behalf of the government, he was its principal organizer, promoter, and technician. In fact, it appears he worked closely with the government when it created the Anom device. As such, he is a percipient witness with first-hand knowledge of many of the relevant facts and a participant in numerous forms of communication with one or more of the defendants,” the motion continues. Pointing to previous precedent, Griffin adds information about the CHS is required for the defense to fulfill its obligations under the Fifth and Sixth Amendments.

“As to timing, trial is fast approaching, and given the worldwide scope of this case, the defense needs time to adequately prepare, including developing impeachment material for the CHS, who undoubtedly will be the government’s key witness,” Griffin writes. That trial is slated for March.

💡
Do you know anything else about Anom, Sky, Encrochat or another encrypted phone company? I would love to hear from you. Using a non-work device, you can message me securely on Signal at +44 20 8133 5190. Otherwise, send me an email at [email protected].

Griffin is seeking Afgoo’s real name; any aliases; their full criminal background including arrests, charges, and convictions; details on any compensation or benefits they received as part of being a CHS; any promises, agreements, or understandings between them and the government, including immunity, immigration benefits, or sentencing recommendations; records showing whether they’ve ever been untruthful or unreliable in any case; information about any psychological or substance abuse history that could impact their reliability as a witness; and all communications between the government and the CHS, among other things.

The reason for seeking this information, Griffin says, is that the defense “is entitled to investigate his background and prepare a vigorous cross examination.”

According to Griffin, in an October meeting the government indicated it would provide the CHS’s name and other details, but did not provide a date at which it would do so. Hence the motion for discovery, which also requests other information about Anom’s operations. A government response filed shortly after said “the government has already advised Dmitrienko that it will be providing discovery relating to the CHS. The government will identify the CHS in advance of trial.” On December 13, the court granted the motion for discovery in part.

Joshua Mellor, one of the main prosecutors on the Anom cases, told 404 Media in an email that “if the case does go to trial, we will have to reveal the identity of the CHS.”

“It would first be revealed in discovery and then in public court if the CHS testifies,” he added.

The defense has already obtained significant discovery, including technical documents on how the Anom system worked and a massive trove of Anom messages, according to other court records.

The motion for discovery also explicitly mentions my book DARK WIRE, which revealed many new details about the Anom operation. “Mr. Dmitrienko is informed and believes the government secured a private jet to deliver a large shipment of Anom phones from the United States to Western Europe to fulfill demand it created after shutting down the Sky system of encrypted devices. (Discussed in the book Dark Wire and raised at our last motion hearing; the government did not dispute undersigned counsel’s recitation of this incident and presumably would have if it were untrue.),” the court record reads. That scene of the book was based on my conversations with FBI officials.

Podcast: The New Jersey Drone Panic

Podcast: The New Jersey Drone Panic

This week Jason, as both a drones and aliens reporter, tells us what is most likely happening with the mysterious drones flying over New Jersey. After the break, Joseph explains how cops in Serbia are using Cellebrite phone unlocking tech as a doorway to installing malware on activists' and journalists' phones. In the subscribers-only section, Sam tells us all about an amazing art project using traffic cameras in New York City.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7

DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7

The Department of Homeland Security (DHS) believes that China, Russia, Iran, and Israel are the “primary” countries exploiting security holes in telecommunications networks to spy on people inside the United States, which can include tracking their physical movements and intercepting calls and texts, according to information released by Senator Ron Wyden.

The news provides more context around use of SS7, the exploited network and protocol, against phones in the country. In May, 404 Media reported that an official inside DHS’s Cybersecurity Infrastructure and Security Agency (CISA) broke with his department’s official narrative and publicly warned about multiple SS7 attacks on U.S. persons in recent years. Now, the newly disclosed information provides more specifics on where at least some SS7 attacks are originating from.

The information is included in a letter the Department of Defense (DoD) wrote in response to queries from the office of Senator Wyden. The letter says that in September 2017 DHS personnel gave a presentation on SS7 security threats at an event open to U.S. government officials. The letter says that Wyden staff attended the event and saw the presentation. One slide identified the “primary countries reportedly using telecom assets of other nations to exploit U.S. subscribers,” it continues.

Cellebrite Unlocked This Journalist’s Phone. Cops Then Infected it With Malware

Cellebrite Unlocked This Journalist’s Phone. Cops Then Infected it With Malware

Authorities in Serbia have repeatedly used Cellebrite tools to unlock mobile phones so they could then infect them with potent malware, including the phones of activists and a journalist, according to a new report from human rights organization Amnesty International.

The report is significant because it shows that although Cellebrite devices are typically designed to unlock or extract data from phones that authorities have physical access to, they can also be used to open the door for installing active surveillance technology. In these cases, the devices were infected with malware and then returned to the targets. Amnesty also says it, along with researchers at Google, discovered a vulnerability in a wide spread of Android phones which Cellebrite was exploiting. Qualcomm, the impacted chip manufacturer, has since fixed that vulnerability. And Amnesty says Google has remotely wiped the spyware from other infected devices.

“I am concerned by the way police behave during the incident, especially the way how they took/extracted the data from my mobilephone without using legal procedures. The fact that they extracted 1.6 GB data from my mobilephone, including personal, family and business information as well as information about our associates and people serving as a ‘source of information’ for journalist research, is unacceptable,” Slaviša Milanov, deputy editor and journalist of Serbian outlet FAR and whose phone was targeted in such a way, told 404 Media. Milanov covers, among other things, corruption. 

Podcast: 3D Printed Guns and UnitedHealthcare

Podcast: 3D Printed Guns and UnitedHealthcare

This week we start with Joseph's story about how the weapon found on the alleged UnitedHealthcare CEO murderer was a particular 3D printed design. Then Jason tells us what he found about the alleged killer Luigi Mangione through his online accounts, and why, ultimately, this kind of journalism might not matter. After the break, Sam talks about how various healthcare companies removed pages about their leadership after the murder, and what we're seeing when it comes to social content moderation around it. In the subscribers-only section, we talk about Congress getting big mad at Apple and Google after 404 Media's reporting on deepfake apps.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

Location Data Firm Offers to Help Cops Track Targets via Doctor Visits

Location Data Firm Offers to Help Cops Track Targets via Doctor Visits

This article was produced with support from the Capitol Forum.

A location data company is asking police for the address of specific people’s doctors in case that can be useful in finding their mobile phone in a massive set of peoples’ location data, according to a document provided to U.S. law enforcement and obtained by 404 Media.

The document is a “Project Intake Form” that asks police for information about the person of interest they would like to track, such as biographical information and known locations, including family and friends' addresses and doctors offices they may visit. It shows that, in a time when surveillance of abortion and reproductive health clinics could rise in a post-Roe America, companies providing monitoring tools to the government are prepared to use healthcare information to track down targets. The company is called Fog Data Science, and its product uses location data harvested from smartphones either through ordinary apps or the advertising ecosystem. In 2022 the Electronic Frontier Foundation (EFF) revealed Fog had sold its phone tracking technology to multiple U.S. agencies, including local police. The document is included in a set of emails from March this year that 404 Media obtained through a public records request, showing the company is still pitching its technology to local law enforcement.

“Your objectives help us target what you want most. Details about the POI [person of interest] help us eliminate devices more efficiently,” the document reads. It then asks for details on the target, such as their name or known aliases, their link to criminal activity, their “distinguishing characteristics” such as their “gender, ethnicity, religion.”

UnitedHealthcare Shooting Person of Interest Had 3D Printed Glock

UnitedHealthcare Shooting Person of Interest Had 3D Printed Glock

The weapon found on the arrested person of interest in the murder of UnitedHealthcare CEO Brian Thompson is a specific 3D printed Glock frame called the Chairmanwon V1, two people in the 3D printed weapons community told 404 Media after viewing an image of the weapon provided to media outlets by police. 

The news is significant in that it could be the first assassination in the United States using a 3D printed weapon, and could usher in fresh calls to further regulate the printing of firearms by ordinary citizens. The finding comes after police arrested a person of interest, Luigi Mangione, on Monday in Pennsylvania. Mangione has now been charged with a handful of crimes, including carrying a gun without a license, but he has not been charged with the murder itself.

“I can confirm that it is a 3D printed Glock. It’s a V1 chairmanwon design,” Print Shoot Repeat, a pseudonymous and high profile member of the 3D printing firearms community told 404 Media in an online chat. “It appears to be the first high profile case involving a 3D printed gun and it’s my guess that this will have a huge impact on DIY firearms regulations going forward.”

Podcast: Your Bluesky Posts Are Probably Training AI

Podcast: Your Bluesky Posts Are Probably Training AI

We start this week with Sam's stories about multiple people building big datasets of Bluesky users' posts. People are not happy! After the break, Jason talks all about reverse-engineering Redbox machines, and a trip he took to see one being ripped up. In the subscribers-only section, Joseph explains two big moves the U.S. government is making against data brokers.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

FTC Bans Location Data Company That Powers the Surveillance Ecosystem

FTC Bans Location Data Company That Powers the Surveillance Ecosystem

The Federal Trade Commission (FTC) announced sweeping action against some of the most important companies in the location data industry on Tuesday, including those that power surveillance tools used by a wide spread of U.S. law enforcement agencies and demanding they delete data related to certain sensitive areas like health clinics and places of worship. 

Venntel, through its parent company Gravy Analytics, takes location data from smartphones, either through ordinary apps installed on them or through the advertising ecosystem, and then provides that data feed to other companies who sell location tracking technology to the government or sells the data directly itself. Venntel is the company that provides the underlying data for a variety of other government contractors and surveillance tools, including Locate X. 404 Media and a group of other journalists recently revealed Locate X could be used to pinpoint phones that visited abortion clinics. 

The FTC says in a proposed order that Gravy and Venntel will be banned from selling, disclosing, or using sensitive location data, except in “limited circumstances” involving national security or law enforcement. Sensitive locations include medical facilities, religious organizations, correctional facilities, labor union offices, schools and childcare facilities, domestic abuse and homeless support centers, shelters for refugee or immigrant populations, and military installations. The FTC also demands that the companies delete all historic location data. 

U.S. Government Tries to Stop Data Brokers That Help Dox People Through Credit Data

U.S. Government Tries to Stop Data Brokers That Help Dox People Through Credit Data

On Tuesday the Consumer Financial Protection Bureau (CFPB) published a long anticipated proposed rule change around how data brokers handle peoples’ sensitive information, including their name and address, which would introduce increased limits on when brokers can distribute such data. Researchers have shown how foreign adversaries are able to easily purchase such information, and 404 Media previously revealed that this particular data supply chain is linked to multiple acts of violence inside the cybercriminal underground that has spilled over to victims in the general public too.

The proposed rule in part aims to tackle the distribution of credit header data. This is the personal information at the top of a credit report which doesn’t discuss the person’s actual lines of credit. But currently credit header data is distributed so widely, to so many different companies, that it ends up in the hands of people who use it maliciously.

The impact of the proposed rule change if it was to go into force won’t be clear until it actually happens, which potentially would not be until at least next year. And that might be up in the air: Elon Musk who is playing a key role in the transition to the forthcoming Trump administration and venture capitalist Marc Andreessen have both criticized the agency. But the proposed rule change still shows a significant effort by a U.S. government agency to wrangle the data broker industry.

Podcast: Pokémon Go to The Military Industrial Complex

Podcast: Pokémon Go to The Military Industrial Complex

This week we start with Emanuel's couple of stories about Niantic, the company that makes Pokémon Go, and its plan to build an AI model based on data collected by its users. After the break, Jason and Emanuel talk about their big investigation into the rise of "AI pimping." In the subscribers-only section, Joseph explains why he doesn't use a mobile phone and how he uses an iPad Mini instead.

Listen to the weekly podcast on Apple Podcasts, Spotify, or YouTube. Become a paid subscriber for access to this episode's bonus content and to power our journalism. If you become a paid subscriber, check your inbox for an email from our podcast host Transistor for a link to the subscribers-only version! You can also add that subscribers feed to your podcast app of choice and never miss an episode that way. The email should also contain the subscribers-only unlisted YouTube link for the extended video version too. It will also be in the show notes in your podcast player.

❌